{ "jurisdiction_id": "CY", "jurisdiction": "Cyprus", "url": "https://payments.gi/jurisdictions/cyprus/", "generator": "render_jid v13.3.0", "date_modified": "2026-08-11", "schema_version": "world-payments-v1", "counts": { "modules": 14, "sourced_findings": 53, "source_register": 93 }, "modules": [ { "code": "W1a", "name": "Licensing, Authorisation & Market Access", "confidence": "Confirmed", "moved_this_cycle": true, "url": "https://payments.gi/jurisdictions/cyprus/#w1a-licensing-authorisation-market-access", "standing_position": "Cyprus payment/e-money regulation runs under PSD2's national transposition (Law 31(I)/2018) and the EMI law, both supervised by the Central Bank of Cyprus (CBC); MiCA now sits alongside as the mandatory CASP/EMT framework, with dual CBC PI/EMI + CySEC CASP authorisation required from March 2026 for EMT-related payment services, and PSD3/PSR is on the horizon to merge the PI/EMI regimes.", "findings": [ { "finding": null, "instrument_type": "Provision and Use of Payment Services and Access to Payment Systems Law of 2018 (Law 31(I)/2018, PSD2)", "source": "https://www.centralbank.cy/en/licensing-supervision/payment-institutions/licensing-and-supervision-of-payment-institutions", "source_url": null, "source_tier": "1", "retrieved_at": null }, { "finding": null, "instrument_type": "Electronic Money Laws of 2012 and 2018 (Law 81(I)/2012, EMD2 2009/110/EC + PSD2 2015/2366)", "source": "https://www.centralbank.cy/en/licensing-supervision/electronic-money-institutions/licensing-and-supervision-of-electronic-money-institutions", "source_url": null, "source_tier": "1", "retrieved_at": null }, { "finding": null, "instrument_type": "capital thresholds", "source": "https://www.sovereigngroup.com/cyprus/corporate-services/payment-institutions-and-electronic-money-institutions/", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "PI initial-capital tiering", "source": "https://obtained.com/blog/emi-pi-application-cyprus-mica-casp", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "EMI authorisation register entry", "source": "https://thebanks.eu/emis/jcc-payment-systems-355373", "source_url": null, "source_tier": "3", "retrieved_at": null } ] }, { "code": "W1b", "name": "Conduct, Safeguarding & Financial Promotions", "confidence": "Confirmed", "moved_this_cycle": true, "url": "https://payments.gi/jurisdictions/cyprus/#w1b-conduct-safeguarding-financial-promotions", "standing_position": "Safeguarding of user funds (segregation or insurance/guarantee) is mandated under the EMI/PI laws, with CBC adopting EBA safeguarding guidance (EBA/GL/2018/05). In 2025-2026 the CBC issued new directives strengthening EMI/PSP governance, capital and suitability, and the Internal Organisation and Governance of EMIs Directive (incorporating by analogy the Internal Organisation and Governance of Payment Institutions Directive of 2026) moved governance to a structured, board-accountable obligation. Suitability of management body members is assessed under the 2025 Suitability Directive.", "findings": [ { "finding": null, "instrument_type": "EBA safeguarding guidance", "source": "https://cxfinancia.com/what-is-a-payment-services-licence-in-cyprus/", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "CBC 2025 EMI/PSP directives", "source": "https://www.harneys.com/our-blogs/regulatory/the-central-bank-of-cyprus-introduces-new-directives-for-emis-and-psps/", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "Internal Organisation and Governance of EMIs Directive", "source": "https://mnkriskconsulting.com/regulatory-developments/central-bank-of-cyprus-directive-on-the-internal-organisation-and-governance-of-electronic-money-institutions/", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "Suitability Directive 2025", "source": "https://www.centralbank.cy/en/licensing-supervision/electronic-money-institutions/licensing-and-supervision-of-electronic-money-institutions", "source_url": null, "source_tier": "1", "retrieved_at": null } ] }, { "code": "W2", "name": "Stablecoins & Digital Money", "confidence": "Confirmed", "moved_this_cycle": false, "url": "https://payments.gi/jurisdictions/cyprus/#w2-stablecoins-digital-money", "standing_position": "MiCA (Reg (EU) 2023/1114): CBC is competent authority for EMTs (Title IV); CySEC supervises ARTs (Title III), other crypto-assets (Title II) and CASPs (Title V). EMT issuance restricted to credit institutions/EMIs. Transitional window to 1 July 2026.", "findings": [ { "finding": null, "instrument_type": "MiCA Regulation (EU) 2023/1114", "source": "https://www.cysec.gov.cy/en-GB/mica-regulation-overview/", "source_url": null, "source_tier": "1", "retrieved_at": null }, { "finding": null, "instrument_type": "EMT competent-authority allocation", "source": "https://www.globallegalinsights.com/practice-areas/fintech-laws-and-regulations/cyprus/", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "MiCA Title IV EMT issuance restriction", "source": "https://finance.yahoo.com/news/revolut-secures-mica-license-cyprus-160103192.html", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "MiCA Art.143 transitional provisions (CySEC guidance)", "source": "https://www.financemagnates.com/cryptocurrency/cysec-outlines-transitional-rules-for-crypto-asset-service-providers-under-mica/", "source_url": null, "source_tier": "2", "retrieved_at": null } ] }, { "code": "W3", "name": "Operational Resilience & Critical Infrastructure", "confidence": "Confirmed", "moved_this_cycle": false, "url": "https://payments.gi/jurisdictions/cyprus/#w3-operational-resilience-critical-infrastructure", "standing_position": "Operational resilience is governed by DORA (Regulation (EU) 2022/2554), directly applicable from 17 January 2025, with CySEC and CBC as the supervising authorities for in-scope entities (banks, PIs, EMIs, investment firms, CASPs). DORA mandates ICT risk-management frameworks, incident classification/reporting, digital operational resilience testing (TLPT every three years for significant entities, with proportionality exemptions for smaller PIs/EMIs) and ICT third-party/outsourcing oversight. CySEC issued implementing guidance, including Circular C751 in early 2026.", "findings": [ { "finding": null, "instrument_type": "DORA Regulation (EU) 2022/2554", "source": "https://www.kyprianou.com/digital-operational-resilience-act-dora-key-compliance-considerations-for-cyprus-financial-entities/", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "DORA testing/TLPT regime", "source": "https://www.harneys.com/our-blogs/regulatory/cysec-publishes-the-main-aspects-of-the-implementation-of-the-digital-operational-resilience-framework-dora/", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "CySEC Circular C751", "source": "https://www.cyprus-insider.com/cysec-accelerates-dora-implementation-strengthening-cypruss-digital-operational-resilience/", "source_url": null, "source_tier": "3", "retrieved_at": null } ] }, { "code": "W4", "name": "Scheme & Network Compliance", "confidence": "Confirmed", "moved_this_cycle": false, "url": "https://payments.gi/jurisdictions/cyprus/#w4-scheme-network-compliance", "standing_position": "Card-scheme economics are governed by the EU Interchange Fee Regulation (EU 2015/751) implemented domestically by Cyprus Law N.77(I)/2018, with the CBC, the Commission for the Protection of Competition and the Consumer Protection Service as joint competent authorities. Caps are 0.2% (debit) and 0.3% (credit). Visa, Mastercard, Diners and China UnionPay schemes run through JCC, the domestic acquirer/processor. PCI DSS and 3-D Secure apply at the acquiring layer. SEPA SCT Inst rails operate under the EU Instant Payments Regulation with mandatory Verification of Payee.", "findings": [ { "finding": null, "instrument_type": "Interchange Fee Regulation (EU 2015/751) + Cyprus Law N.77(I)/2018", "source": "https://www.centralbank.cy/en/financial-market-infrastructures-payments/interchange-fee-regulation", "source_url": null, "source_tier": "1", "retrieved_at": null }, { "finding": null, "instrument_type": "IFR caps", "source": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32015R0751", "source_url": null, "source_tier": "1", "retrieved_at": null }, { "finding": null, "instrument_type": "EU Instant Payments Regulation / SCT Inst", "source": "https://www.lightspark.com/knowledge/cyprus-instant-payments", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "PCI DSS / 3-D Secure scheme compliance", "source": "https://www.ecommerce-payments.com/en/english-jcc-payment-system.html", "source_url": null, "source_tier": "3", "retrieved_at": null } ] }, { "code": "W5", "name": "Payment Corridor Dynamics", "confidence": "High", "moved_this_cycle": true, "url": "https://payments.gi/jurisdictions/cyprus/#w5-payment-corridor-dynamics", "standing_position": "As a euro-area member, Cyprus's principal corridors are euro-denominated SEPA flows (SCT, SCT Inst, SDD) settled in T2-CY, with non-euro cross-border flows reliant on correspondent networks. The Cyprus SEPA Direct Debit system (CY-SDD) has operated since 2014, settling in T2-CY; TIPS access provides pan-European instant reach across the 36-country SEPA zone. The CBC operates TARGET-CY and stands ready to support local credit institutions accessing TIPS.", "findings": [ { "finding": null, "instrument_type": "CY-SDD / SEPA retail rails", "source": "https://www.centralbank.cy/en/financial-market-infrastructures-payments/financial-market-infrastructures-instruments/retail-payment-systems", "source_url": null, "source_tier": "1", "retrieved_at": null }, { "finding": null, "instrument_type": "SCT Inst / TIPS corridor reach", "source": "https://www.lightspark.com/knowledge/cyprus-instant-payments", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "cross-border correspondent reliance", "source": "https://www.transfi.com/blog/cyprus-payment-rails-how-they-work---sepa-jcc-mobile-wallets", "source_url": null, "source_tier": "3", "retrieved_at": null } ] }, { "code": "W6", "name": "Industry Structure & Commercial Dynamics", "confidence": "Confirmed", "moved_this_cycle": false, "url": "https://payments.gi/jurisdictions/cyprus/#w6-industry-structure-commercial-dynamics", "standing_position": "The Cyprus payments market is bank-led at the acquiring layer, dominated by JCC Payment Systems Ltd — a bank-owned consortium (Bank of Cyprus holds a controlling/circa-75% interest; other shareholders include Hellenic Bank, Alpha Bank Cyprus, National Bank of Greece (Cyprus) and AstroBank) acting as the primary card processor. As of 2026 the CBC supervises around 26 EMIs and 11 PIs. Card payments accounted for ~74.5% of cashless transactions in H1 2025, above the euro-area average, and fintechs are emerging as a competitive challenge to incumbent banks.", "findings": [ { "finding": null, "instrument_type": "market structure (CBC FMI register)", "source": "https://www.centralbank.cy/en/financial-market-infrastructures-payments/financial-market-infrastructures-instruments/retail-payment-systems", "source_url": null, "source_tier": "1", "retrieved_at": null }, { "finding": null, "instrument_type": "ownership/concentration", "source": "https://cy.linkedin.com/company/jcc-payment-systems", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "supervised population", "source": "https://bankmycapital.com/cyprus-payment-agents-secure-banking-high-risk/", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "market-share dynamics", "source": "https://cyprus-mail.com/2026/06/15/cyprus-turns-to-digital-payments-as-fintech-reshapes-banking", "source_url": null, "source_tier": "3", "retrieved_at": null } ] }, { "code": "W7", "name": "Legal & Litigation", "confidence": "High", "moved_this_cycle": false, "url": "https://payments.gi/jurisdictions/cyprus/#w7-legal-litigation", "standing_position": "Enforcement in the payments-adjacent space is driven by CySEC (CIFs, CASPs, funds) and CBC (credit institutions, PIs, EMIs), plus the National Sanctions Implementation Unit (NSIU). In its 2025 review CySEC reported imposing €2.3 million in fines and ~600 inspections, with thematic inspections in retail FX/CFD and crypto-asset sectors producing administrative fines for sanctions-screening and prudential-reporting deficiencies. The Criminalisation of the Violation of Restrictive Measures Law (2025) empowers the NSIU to impose fines up to €5 million or 10% of annual turnover. CySEC lacks restitution powers; consumer redress runs through the Financial Ombudsman and the District Courts.", "findings": [ { "finding": null, "instrument_type": "CySEC enforcement (2025 annual review)", "source": "https://cyprus-mail.com/2026/01/21/cysec-imposes-e2-3-million-in-fines-tightens-aml-and-sanctions-enforcement", "source_url": null, "source_tier": "2", "retrieved_at": null }, { "finding": null, "instrument_type": "Criminalisation of the Violation of Restrictive Measures Law (2025)", "source": "https://practiceguides.chambers.com/practice-guides/fintech-2026/cyprus/trends-and-developments", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "redress / dispute route", "source": "https://www.cysec.gov.cy/en-GB/investor-protection/how-to-complain/", "source_url": null, "source_tier": "1", "retrieved_at": null } ] }, { "code": "W8", "name": "Merchant Acquiring & Risk", "confidence": "High", "moved_this_cycle": false, "url": "https://payments.gi/jurisdictions/cyprus/#w8-merchant-acquiring-risk", "standing_position": "Domestic merchant acquiring is dominated by JCC Payment Systems, the primary card processor and acquirer for Visa, Mastercard, Diners and China UnionPay, providing the JCC Gateway (online card capture and 3-D Secure), JCCsmart (public-sector/biller acceptance), POS terminals, fraud controls, tokenisation, rolling reserves and chargeback handling. Cross-border PSPs (Adyen, Stripe, Mollie, Worldline) compete for EU-footprint merchants. High-risk merchant onboarding is constrained by bank AML/KYC policies, with specialist high-risk providers and PayFac models filling the gap.", "findings": [ { "finding": null, "instrument_type": "acquiring operations", "source": "https://www.transfi.com/blog/cyprus-payment-rails-how-they-work---sepa-jcc-mobile-wallets", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "merchant onboarding/risk", "source": "https://payatlas.com/countries/cyprus-cy", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "chargeback/rolling-reserve mechanics", "source": "https://www.ecommerce-payments.com/en/english-jcc-payment-system.html", "source_url": null, "source_tier": "3", "retrieved_at": null } ] }, { "code": "W9", "name": "Product Innovation & Market Development", "confidence": "High", "moved_this_cycle": true, "url": "https://payments.gi/jurisdictions/cyprus/#w9-product-innovation-market-development", "standing_position": "Cyprus's legacy AML-only national CASP registration regime has been fully retired: the MiCA grandfathering window (Article 143(3)) closed on 1 July 2026, after a 27 February 2026 application deadline, moving all CASPs onto full EU MiCA authorisation or a mandated wind-down.", "findings": [ { "finding": null, "instrument_type": "CBC + CySEC Innovation Hubs / Regulatory Sandbox", "source": "https://www.globallegalinsights.com/practice-areas/fintech-laws-and-regulations/cyprus/", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "sandbox mechanics / open banking", "source": "https://practiceguides.chambers.com/practice-guides/fintech-2026/cyprus/trends-and-developments", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "digital euro readiness", "source": "https://cyprus-mail.com/2026/06/15/cyprus-turns-to-digital-payments-as-fintech-reshapes-banking", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "mobile wallets / request-to-pay", "source": "https://www.transfi.com/blog/cyprus-payment-rails-how-they-work---sepa-jcc-mobile-wallets", "source_url": null, "source_tier": "3", "retrieved_at": null } ] }, { "code": "W10", "name": "Consumer Protection & APP Fraud", "confidence": "High", "moved_this_cycle": false, "url": "https://payments.gi/jurisdictions/cyprus/#w10-consumer-protection-app-fraud", "standing_position": "Consumer protection rests on PSD2-derived conduct rules, transparency/disclosure obligations, and EBA consumer-protection guidance adopted by the CBC. The Office of the Cyprus Financial Commissioner (Financial Ombudsman), established under Law 84(I)/2010, handles consumer complaints against banks, PIs/EMIs and other financial institutions up to €250,000 (€20 fee; decisions binding only if accepted by both parties). For instant-payment fraud, the EU Instant Payments Regulation's mandatory Verification of Payee (payee name/IBAN matching) is the principal APP/misdirection-fraud control; Cyprus does not have a UK-style mandatory APP-fraud reimbursement scheme.", "findings": [ { "finding": null, "instrument_type": "Financial Ombudsman Law 84(I)/2010", "source": "https://financialombudsman.org.cy/en/services/complaints-service/", "source_url": null, "source_tier": "1", "retrieved_at": null }, { "finding": null, "instrument_type": "complaint scope cap", "source": "https://financialombudsman.org.cy/en/complaints-submission-and-mediation-requests/submission-of-a-complaint-by-legal-entities/", "source_url": null, "source_tier": "1", "retrieved_at": null }, { "finding": null, "instrument_type": "Verification of Payee (APP-fraud control)", "source": "https://www.lightspark.com/knowledge/cyprus-instant-payments", "source_url": null, "source_tier": "3", "retrieved_at": null } ] }, { "code": "W11", "name": "AML/CFT & Financial Crime", "confidence": "Assessed", "moved_this_cycle": false, "url": "https://payments.gi/jurisdictions/cyprus/#w11-aml-cft-financial-crime", "standing_position": "[Sentinel-fed] Cyprus AML/CFT for the payments context is governed by the AML/CFT Law of 2007 and Sanctions Law of 2016, with sector supervisors CBC (credit institutions, PIs, EMIs), CySEC (CIFs, CASPs, funds), ICPAC and the Cyprus Bar Association; MOKAS is the FIU. CASPs are obliged entities registered with CySEC and subject to Travel Rule (Reg (EU) 2023/1113) obligations and CDD from €1,000. Sentinel.gi position carried; no original WPM illicit-finance analysis performed.", "findings": [ { "finding": null, "instrument_type": "firm-wide sanctions risk assessment", "source": "sentinel://cy/aml-cft/sanctions-supervision — centre8education.com/articles/aml-sanction-risk-assesment-cyprus", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": "Cyprus applies the EU AML/CFT acquis via its AML/CFT Law, with MOKAS as FIU, CySEC as securities/CASP supervisor, and CBC as banking supervisor. Assessed by MONEYVAL under FATF standards, Cyprus remains in enhanced follow-up since its 2019 MER, rated partially compliant on non-profit organisations, correspondent banking, new technologies (crypto), and law-enforcement investigative powers. A national sanctions unit (NSIU/MEK), replacing a 2016 sanctions law, was legislated in 2025 after EU-deadline delays.", "instrument_type": "assessment", "source": "FIM (sentinel.gi) per-JID baseline profile — Cyprus", "source_url": null, "source_tier": null, "retrieved_at": null }, { "finding": "Gap: sourcing-thinness", "instrument_type": "gap", "source": "FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-001)", "source_url": null, "source_tier": null, "retrieved_at": null }, { "finding": "Enforcement: MONEYVAL/FATF — Cyprus national AML/CFT framework", "instrument_type": "enforcement_action", "source": "FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-003)", "source_url": null, "source_tier": "1", "retrieved_at": null }, { "finding": "Gap: enforcement-absence", "instrument_type": "gap", "source": "FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-003)", "source_url": null, "source_tier": null, "retrieved_at": null }, { "finding": "Enforcement: Nicosia Criminal Court — Demetris Syllouris (former Parliament President) and Christakis Giovanis (former MP)", "instrument_type": "enforcement_action", "source": "FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-004)", "source_url": null, "source_tier": "2", "retrieved_at": null }, { "finding": "Gap: regulatory-failure", "instrument_type": "gap", "source": "FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-004)", "source_url": null, "source_tier": null, "retrieved_at": null } ] }, { "code": "W12", "name": "Correspondent Banking, Settlement & Access", "confidence": "Confirmed", "moved_this_cycle": false, "url": "https://payments.gi/jurisdictions/cyprus/#w12-correspondent-banking-settlement-access", "standing_position": "Settlement via T2-CY (replaced TARGET2 20 Mar 2023); Settlement Finality Law; TIPS + CCBM connectivity; non-euro flows exposed to de-risking.", "findings": [ { "finding": null, "instrument_type": "T2-CY RTGS / settlement finality law", "source": "https://www.centralbank.cy/en/financial-market-infrastructures-payments/financial-market-infrastructures-instruments/target-services", "source_url": null, "source_tier": "1", "retrieved_at": null }, { "finding": null, "instrument_type": "Correspondent Central Banking Model (CCBM)", "source": "https://www.ecb.europa.eu/pub/pdf/other/ccbm201405en.pdf", "source_url": null, "source_tier": "1", "retrieved_at": null }, { "finding": null, "instrument_type": "de-risking pressure", "source": "https://www.ecb.europa.eu/pub/pdf/eurosystemoversight/eurosystemoversightreport2020~a1e4fce1d7.en.pdf", "source_url": null, "source_tier": "1", "retrieved_at": null } ] }, { "code": "W13", "name": "Commercial Intelligence & Fintech", "confidence": "Assessed", "moved_this_cycle": true, "url": "https://payments.gi/jurisdictions/cyprus/#w13-commercial-intelligence-fintech", "standing_position": "Trailing-12-month commercial activity is shaped by MiCA-driven crypto re-domiciliation into Cyprus and bank consolidation. Revolut secured a CySEC MiCA CASP licence (October 2025), making Cyprus its EEA crypto hub. Bank of Cyprus (CET1 ~21%) signalled openness to smaller, strategically targeted fintech/insurance acquisitions under its 2026-2028 plan. 2025 saw a significant rise in tech/fintech/financial-services M&A. Earlier CASP registrations included Revolut and eToro; Binance exited the market.", "findings": [ { "finding": null, "instrument_type": "commercial_event: MiCA CASP licence", "source": "https://www.cryptopolitan.com/revolut-eu-mica-license-in-cyprus/", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "commercial_event: M&A appetite", "source": "https://cyprus-mail.com/2026/03/05/bank-of-cyprus-targets-fintech-and-insurance-for-strategic-deals", "source_url": null, "source_tier": "3", "retrieved_at": null }, { "finding": null, "instrument_type": "commercial_event: M&A trend", "source": "https://practiceguides.chambers.com/practice-guides/corporate-ma-2026/cyprus/trends-and-developments", "source_url": null, "source_tier": "3", "retrieved_at": null } ] } ] }